Microsoft warns that cybercriminals are using BNB Chain contracts to spread malware via fake CAPTCHAs, risking credential theft and network access.
Cybercriminals Exploit BNB Chain for Malware Distribution
Cybercriminals are increasingly leveraging BNB Smart Chain contracts to distribute malware, as highlighted in a recent report by Microsoft Threat Intelligence. This operation employs compromised websites and fake CAPTCHA prompts to mislead users into executing harmful commands.
In a post on X, Microsoft detailed how attackers utilize a method called EtherHiding, which conceals malicious commands within blockchain smart contracts. Compromised sites use JavaScript to communicate with a BNB Chain gateway, fetching instructions from a contract linked to ClearFake, a malware initiative targeting legitimate websites.
This approach complicates the removal of these malicious commands, as only the wallet managing the contract can modify its contents, thereby undermining conventional takedown efforts.
Victims visiting these compromised sites encounter deceptive CAPTCHA prompts that instruct them to access the Windows Run dialog, paste clipboard content, and hit Enter, which executes commands supplied by the attackers. This strategy, referred to as ClickFix, relies on users unwittingly executing malware. Another variant, TerminalFix, directs users to use Windows Terminal or PowerShell.
Researchers from Microsoft stated, "This campaign illustrates that ClickFix and TerminalFix are highly prevalent initial access strategies." They noted that such campaigns impact thousands of enterprise and consumer devices daily, with some malvertising networks directing users to scam sites.
Hackers are known to conceal their commands and exploit legitimate Windows tools like PowerShell, cmd, and others. A successful infection could compromise user credentials, provide ongoing access, and facilitate lateral movement within networks, possibly leading to ransomware attacks or significant breaches.
The use of blockchains in malware operations is not new. For instance, Cerber ransomware began using Bitcoin transactions in 2016 to identify command-and-control servers, and the Glupteba botnet utilized Bitcoin from 2019 to 2021 for similar purposes. Recently, in September 2023, ClearFake began employing EtherHiding to retrieve malicious code from BNB Chain smart contracts.
In light of these developments, Microsoft has recommended that organizations restrict unnecessary command-line tools, enable PowerShell logging, and implement stricter application controls. They also advised users to refrain from pasting commands from CAPTCHAs or unsolicited sources into any command-line interfaces.
